fix -ULDAP_DEVEL compile

[openldap] / servers / slapd / back-ldap / bind.c

diff --git a/servers/slapd/back-ldap/bind.c b/servers/slapd/back-ldap/bind.c
index 446ce1c458a74c0765857f0782154de1545b1d99..ce991e476c96b8e84ebf505a1efe4d04827f0a13 100644 (file)
--- a/servers/slapd/back-ldap/bind.c
+++ b/servers/slapd/back-ldap/bind.c
@@ -251,7 +251,7 @@ ldap_back_prepare_conn( struct ldapconn **lcp, Operation *op, SlapReply *rs, lda
        if ( ( LDAP_BACK_USE_TLS( li ) || ( op->o_conn->c_is_tls && LDAP_BACK_PROPAGATE_TLS( li ) ) )
                                && !ldap_is_ldaps_url( li->url ) )
        {
-#if 1
+#ifdef SLAP_STARTTLS_ASYNCHRONOUS
                /*
                 * use asynchronous StartTLS
                 * in case, chase referral (not implemented yet)
@@ -315,12 +315,12 @@ retry:;
                                ldap_msgfree( res );
                        }
                }
-#else
+#else /* ! SLAP_STARTTLS_ASYNCHRONOUS */
                /*
                 * use synchronous StartTLS
                 */
                rs->sr_err = ldap_start_tls_s( ld, NULL, NULL );
-#endif
+#endif /* ! SLAP_STARTTLS_ASYNCHRONOUS */
 
                /* if StartTLS is requested, only attempt it if the URL
                 * is not "ldaps://"; this may occur not only in case
@@ -360,8 +360,7 @@ struct ldapconn *
 ldap_back_getconn( Operation *op, SlapReply *rs, ldap_back_send_t sendok )
 {
        struct ldapinfo *li = (struct ldapinfo *)op->o_bd->be_private;
-       struct ldapconn *lc, lc_curr;
-       int             is_priv = 0;
+       struct ldapconn *lc, lc_curr = { 0 };
 
        /* Searches for a ldapconn in the avl tree */
 
@@ -381,7 +380,7 @@ ldap_back_getconn( Operation *op, SlapReply *rs, ldap_back_send_t sendok )
        if ( op->o_do_not_cache || be_isroot( op ) ) {
                lc_curr.lc_local_ndn = op->o_bd->be_rootndn;
                lc_curr.lc_conn = NULL;
-               is_priv = 1;
+               lc_curr.lc_ispriv = 1;
 
        } else {
                lc_curr.lc_local_ndn = op->o_ndn;
@@ -404,9 +403,10 @@ ldap_back_getconn( Operation *op, SlapReply *rs, ldap_back_send_t sendok )
 
                ldap_pvt_thread_mutex_init( &lc->lc_mutex );
 
-               if ( is_priv ) {
+               if ( lc_curr.lc_ispriv ) {
                        ber_dupbv( &lc->lc_cred, &li->acl_passwd );
                        ber_dupbv( &lc->lc_bound_ndn, &li->acl_authcDN );
+                       lc->lc_ispriv = lc_curr.lc_ispriv;
 
                } else {
                        BER_BVZERO( &lc->lc_cred );
@@ -471,7 +471,6 @@ ldap_back_dobind_int(
 
        assert( retries >= 0 );
 
-       ldap_pvt_thread_mutex_lock( &lc->lc_mutex );
        if ( !lc->lc_bound ) {
                struct ldapinfo *li = (struct ldapinfo *)op->o_bd->be_private;
 
@@ -498,6 +497,8 @@ ldap_back_dobind_int(
                 * It allows to use SASL bind and yet proxyAuthz users
                 */
                if ( op->o_conn != NULL &&
+                               !op->o_do_not_cache &&
+                               !be_isroot( op ) &&
                                ( BER_BVISNULL( &lc->lc_bound_ndn ) ||
                                  ( li->idassert_flags & LDAP_BACK_AUTH_OVERRIDE ) ) )
                {
@@ -505,6 +506,51 @@ ldap_back_dobind_int(
                        goto done;
                }
 
+#ifdef HAVE_CYRUS_SASL
+               if ( lc->lc_ispriv && li->acl_authmethod == LDAP_AUTH_SASL ) {
+                       void            *defaults = NULL;
+
+#if 1  /* will deal with this later... */
+                       if ( li->acl_secprops != NULL ) {
+                               rc = ldap_set_option( lc->lc_ld,
+                                       LDAP_OPT_X_SASL_SECPROPS, li->acl_secprops);
+
+                               if( rc != LDAP_OPT_SUCCESS ) {
+                                       Debug( LDAP_DEBUG_ANY, "Error: ldap_set_option "
+                                               "(%s,SECPROPS,\"%s\") failed!\n",
+                                               li->url, li->acl_secprops, 0 );
+                                       goto done;
+                               }
+                       }
+#endif
+
+                       defaults = lutil_sasl_defaults( lc->lc_ld,
+                                       li->acl_sasl_mech.bv_val,
+                                       li->acl_sasl_realm.bv_val,
+                                       li->acl_authcID.bv_val,
+                                       li->acl_passwd.bv_val,
+                                       NULL );
+
+                       rs->sr_err = ldap_sasl_interactive_bind_s( lc->lc_ld,
+                                       li->acl_authcDN.bv_val,
+                                       li->acl_sasl_mech.bv_val, NULL, NULL,
+                                       LDAP_SASL_QUIET, lutil_sasl_interact,
+                                       defaults );
+
+                       lutil_sasl_freedefs( defaults );
+
+                       rs->sr_err = slap_map_api2result( rs );
+                       if ( rs->sr_err != LDAP_SUCCESS ) {
+                               lc->lc_bound = 0;
+                               send_ldap_result( op, rs );
+
+                       } else {
+                               lc->lc_bound = 1;
+                       }
+                       goto done;
+               }
+#endif /* HAVE_CYRUS_SASL */
+
 retry:;
                rs->sr_err = ldap_sasl_bind( lc->lc_ld,
                                lc->lc_bound_ndn.bv_val,
@@ -539,14 +585,19 @@ retry:;
 
 done:;
        rc = lc->lc_bound;
-       ldap_pvt_thread_mutex_unlock( &lc->lc_mutex );
        return rc;
 }
 
 int
 ldap_back_dobind( struct ldapconn *lc, Operation *op, SlapReply *rs, ldap_back_send_t sendok )
 {
-       return ldap_back_dobind_int( lc, op, rs, sendok, 1 );
+       int     rc;
+
+       ldap_pvt_thread_mutex_lock( &lc->lc_mutex );
+       rc = ldap_back_dobind_int( lc, op, rs, sendok, 1 );
+       ldap_pvt_thread_mutex_unlock( &lc->lc_mutex );
+
+       return rc;
 }
 
 /*
@@ -659,18 +710,21 @@ retry:;
 int
 ldap_back_retry( struct ldapconn *lc, Operation *op, SlapReply *rs, ldap_back_send_t sendok )
 {
+       int     rc;
+
        ldap_pvt_thread_mutex_lock( &lc->lc_mutex );
        ldap_unbind_ext_s( lc->lc_ld, NULL, NULL );
        lc->lc_ld = NULL;
        lc->lc_bound = 0;
 
        /* lc here must be the regular lc, reset and ready for init */
-       if ( ldap_back_prepare_conn( &lc, op, rs, sendok ) != LDAP_SUCCESS ) {
-               return 0;
+       rc = ldap_back_prepare_conn( &lc, op, rs, sendok );
+       if ( rc == LDAP_SUCCESS ) {
+               rc = ldap_back_dobind_int( lc, op, rs, sendok, 0 );
        }
-
        ldap_pvt_thread_mutex_unlock( &lc->lc_mutex );
-       return ldap_back_dobind_int( lc, op, rs, sendok, 0 );
+
+       return rc;
 }
 
 static int
@@ -803,7 +857,7 @@ ldap_back_proxy_authz_bind( struct ldapconn *lc, Operation *op, SlapReply *rs )
 
                rs->sr_err = ldap_sasl_interactive_bind_s( lc->lc_ld, binddn.bv_val,
                                li->idassert_sasl_mech.bv_val, NULL, NULL,
-                               li->idassert_sasl_flags, lutil_sasl_interact,
+                               LDAP_SASL_QUIET, lutil_sasl_interact,
                                defaults );
 
                lutil_sasl_freedefs( defaults );
@@ -898,7 +952,7 @@ ldap_back_proxy_authz_ctrl(
                goto done;
        }
 
-       if ( !op->o_conn ) {
+       if ( !op->o_conn || op->o_do_not_cache || be_isroot( op ) ) {
                goto done;
        }